Technical Staff | August 20, 2026
An internal audit finding is not merely a technical observation to be recorded, assigned, and eventually marked “closed.”
It may be an early warning that a control is failing, management is tolerating an exception, authority is being exercised without sufficient challenge, or a known weakness is becoming normalized.
For boards and audit committees, the question is therefore not simply:
The more important question is:
Five Takeaways for Boards and Management
- The formal rating assigned to an internal audit finding may not capture its full governance significance.
- Repeated findings can indicate that management is treating symptoms while leaving the underlying cause unresolved.
- A finding involving management override, delayed remediation, or weak accountability may deserve board attention even when its formal rating is low.
- Closing a finding does not prove that the underlying risk has been reduced.
- Boards should use Competent Questioning to test the causes, evidence, remediation, accountability, and recurrence behind significant findings.
A Familiar Boardroom Trap
Internal audit reports that vendor approvals are sometimes completed after purchases have already been made.
Management describes the issue as procedural. The finding receives a moderate or low rating. A corrective-action date is agreed.
Three months later, management reports that revised procedures have been issued. The finding is closed.
The board may reasonably believe the matter has been resolved.
But what if purchase approvals continue to be bypassed? What if senior managers can still override the process? What if internal audit has identified similar weaknesses before?
The issue was never merely late paperwork. The real issue was whether people could commit organizational resources before meaningful approval occurred.
That distinction matters.
Why a Finding Is More Than a Deficiency
A finding tells the board what internal audit observed. It may not, by itself, explain why the condition existed, how long it persisted, who benefited from it, who had authority to prevent it, or whether management already knew about it.
Those questions determine the finding’s governance significance.
A procurement exception, for example, may appear operational. Repeated exceptions involving the same executives, vendors, or approval routes may tell a different story.
The board should therefore read findings not only individually but also for patterns involving recurrence, authority, management response, and resistance to remediation.
When Repeated Findings Become a Warning
The Walmart FCPA resolution provides a useful example. According to the U.S. Department of Justice, internal audit teams at Walmart’s China subsidiary identified numerous weaknesses in anti-corruption-related internal accounting controls between 2003 and 2011, sometimes repeatedly. The DOJ stated that from approximately 2007 until early 2010, Walmart and the subsidiary failed to address nearly all of those audit findings (U.S. Department of Justice, 2019).
The U.S. Securities and Exchange Commission separately concluded that Walmart had allowed deficient internal accounting controls to persist despite red flags and corruption allegations (U.S. Securities and Exchange Commission, 2019).
When “Closed” Does Not Mean Corrected
The Credit Suisse–Archegos case provides another warning.
In a 2023 Final Notice, the UK Prudential Regulation Authority described a later internal audit review that found previous remediation had not adequately mitigated key risks. Some actions had been closed before the underlying risks were fully remediated, resulting in repeat and newly identified issues (Prudential Regulation Authority, 2023).
Following the collapse of Archegos in 2021, Credit Suisse suffered losses exceeding USD 5 billion. FINMA later found serious and systematic deficiencies in the bank’s risk management and organization in connection with the Archegos relationship (FINMA, 2023).
Competent Questioning Changes How Boards Read Findings
Competent Questioning is an anti-corruption governance concept that provides a disciplined basis for decision-makers to ask clear, relevant, timely, and evidence-seeking questions before accepting conclusions or exercising entrusted authority (Masoud, 2026).
Applied to internal audit, this means a board should not stop at:
Why did the weakness occur?
Was management aware of it before internal audit identified it?
Is it genuinely isolated?
Have similar weaknesses appeared in other locations, functions, or processes?
Who had authority over the condition?
Could someone override the control or tolerate the exception?
What evidence proves remediation works?
Was effectiveness tested, or was closure based mainly on management representation or completion of an action plan?
Could the weakness return?
Has the root cause changed, or has the organization merely corrected the visible symptom?
These questions convert an audit report from information received into governance intelligence.
When a “Low-Risk” Finding Deserves High-Level Attention
A low-rated finding may still matter greatly when it recurs, involves management override, affects a corruption-sensitive process, remains unresolved, reveals weak accountability, or appears across apparently unrelated areas.
Boards should therefore avoid allowing the rating itself to end the inquiry.
What Boards Should Expect
Boards do not need to investigate every finding themselves. They should expect management and internal audit to provide enough evidence to understand significant causes, remediation, recurrence, and residual risk.
Where a finding is repeatedly delayed or closed without convincing evidence of effectiveness, the board should ask why.
Where similar findings appear across the organization, it should ask whether the organization is facing a systemic control weakness rather than separate operational problems.
One Hard Takeaway
An internal audit finding does not protect an organization because it appears in a report, receives an action plan, or is eventually marked “closed.”
Its value depends on what decision-makers do with it.
Competent boards read beyond the finding. They question its cause, challenge management’s explanation, test the evidence supporting remediation, examine patterns of recurrence, and determine whether the underlying risk has actually changed.
Damage grows when known weaknesses become familiar enough to stop attracting serious questions.
References
FINMA (2023) Archegos: FINMA Concludes Proceedings Against Credit Suisse. 24 July. Swiss Financial Market Supervisory Authority. Available at: https://www.finma.ch/en/news/2023/07/20230724-mm-archegos/ (Accessed: 20 August 2026).
Masoud, M. (2026) Competent Questioning: An Anti-Corruption Governance Concept. The American Anti-Corruption Institute. Available at: https://www.theaaci.net/Competent-Questioning (Accessed: 20 August 2026).
Prudential Regulation Authority (2023) Final Notice: Credit Suisse International and Credit Suisse Securities (Europe) Ltd. 21 July. Bank of England. Available at: Bank of England Final Notice (Accessed: 20 August 2026).
U.S. Department of Justice (2019) Walmart Inc. and Brazil-Based Subsidiary Agree to Pay $137 Million to Resolve Foreign Corrupt Practices Act Case. 20 June. Available at: U.S. Department of Justice (Accessed: 20 August 2026).
U.S. Securities and Exchange Commission (2019) Walmart Charged With FCPA Violations. 20 June. Available at: U.S. Securities and Exchange Commission (Accessed: 20 August 2026).
Disclaimer
This article is provided for educational and informational purposes only. It does not constitute legal, regulatory, audit, compliance, or financial advice. Internal audit findings, risk ratings, remediation requirements, and board responsibilities should be evaluated in light of the organization’s circumstances, applicable professional standards, governing documents, and legal and regulatory requirements.
External cases are discussed solely to illustrate governance and internal-control lessons based on the cited official sources.
